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SUMMARY 

This paper presents a review of the F- l2r-,series aircraft control 
system design philosophy as it pertains to functional reliability. The 
basic control system, i. e. , cables, mixer, feel system, trim devices, 
and hydraulic systems are described and discussed. In addition, the 
implementation of the redundant stability augmentation system in the 
F-12 type aircraft is described. Finally, the functional reliability record 
that has been achieved is presented. 


INTRODUCTION 

The F-12 series aircraft were designed more than a decade ago, 
yet they included concepts which have only recently become popular and 
even acceptable. One of these is the fact that, to a certain extent, 
the F-12 aircraft are control configured vehicles (CCV). They were 
designed with the objective of minimizing trim drag to enhance the range 
capabilities. This, of course, immediately implies either very low or 
no static stability requiring the full time services of a pitch stability 
augmentation system (SAS). At high Mach numbers, the Mach effects 
reduce the directional stability. Since an engine failure or inlet unstart 
can produce a violent transient, it is rather obvious that the services of 
a full time yaw stability augmentation system is also important, both 
from the standpoint of pilot comfort and prevention of structural damage 
to the aircraft. These factors dictate a full time stability augmentation 
system in both the pitch and yaw axes and with a functional reliability 
comparable with that of the basic vehicle itself. This paper presents 
descriptions of the basic aircraft control system and the redundant sta- 
bility augmentation systems that permitted us to achieve the necessary 
functional reliability. 
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MANUAL CONTROL SYSTEM 

The configuration of the F-12 series aircraft is illustrated in 
Figure 1. The shaded areas show the hydraulically actuated aerodynamic 
control surfaces. The large inboard and outboard elevons are utilized 
for pitch and roll control. Pilot control stick motion is separated into 
pitch and roll commands by the eleven mixer assembly located in the air- 
craft's tail cone. The outboard eleven is slaved to the inboard eleven 
through a crossover linkage system which transmits commands across the 
hot aft nacelle. The crossover linkage contains a preloaded spring cart- 
ridge to avoid structural damage should the outboard surface jam. The 
rudders are really all-movable vertical tails to provide the necessary 
controllability during engine failure or inlet unstart. 

The aircraft contains four hydraulic supply systems; two of these are 
dedicated to the control system. The two control system hydraulic supplies 
are designated as System A and System B. The eleven surface actuators 
are arranged such that alternating cylinders are supplied by Systems A and I 
Thus, if either hydraulic system is lost, the remaining system will con- 
tinue to provide power for the actuation of all of the surfaces. The 
verticals have a similar load sharing arrangement. 

Since the A and B valves porting hydraulic oil to the surface 
actuators are on a common shaft and in close proximity to each other, 
it is necessary to protect against intersystem leakage in the event of the 
loss of one of the hydraulic supplies. This is done by providing 
"scavenger" jet pumps in the return area for both systems. This results 
in the return of any leakage oil back to the reservoir of the appropriate 
supply instead of loss into the failed supply. 

The roll/pitch eleven mixer is a relatively simple device containing 
the roll and pitch feel springs and trim actuators. No complexities such 
as bobweights or q-bellows are employed, and as a result, has proven to 
be quite reliable. The feel springs for the verticals are located in the 
stub fin and are incorporated into the yaw trim actuators. 

Transmission of pilot stick commands to the eleven control surfaces 
is achieved by dual cable systems to the mixer and from thence to the 
summing levers of the inboard servo eleven valves. The rudder pedal 
motion is also transmitted via a dual cable-pushrod system to the sum- 
ming levers of the vertical servos. The variations in required cable 
length due to temperature effects and flexure of the relatively long fuse- 
lage is compensated for by the use of tension regulators. 
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Electrical power is provided by two identical genei*ators, each driven 
by one of the engines. The generators are synchronized and in normal 
operation share the load. If either generator fails, an autdpiatic relay system 
disconnects the failed system transferring the total load tOj tjhe remaining 
generator. If both engines quit, causing loss of both genq'r^tors, a 
battery /inverter supplies power to the essential bus until ,/t^e engines are 
restarted. / / 

AUTOMATIC FLIGHT CONTROL SYSTEM (AtteS) 

The design goal of the automatic flight control system for the F-12 
series aircraft was to provide optimum handling qualities in the primary 
flight regimes of the aircraft. However, another consideration was to 
provide as simple a system as possible in order to enhance reliability. 

Since the vehicle was the first supersonic cruise vehicle, and thus would 
spend the greater portion of its flight time at high Mach number cruise, 
the handling qualities had to be optimum at these conditions. In addition, 
it was also imperative to provide good response and controllability in the 
critical areas of the flight envelope consisting^ of takeoff, landing and 
refueling. All other flight conditions Were considered transitional where 
handling qualities could be less than optimum in the interest of simplicity. 


The automatic flight control system of the F-12 series aircraft con- 
sists of the stability augmentation system (SAS), the autopilot and the Mach 
trim system. The autopilot is primarily to provide pilot relief modes, 
and although high reliability for this function is desirable, it is not essen- 
tial to safety of flight. Thus, the only protective measures taken in the 
implementation of the autopilot is the provision of duplex fixed authority 
limits set to prevent excessive transients for hardover failures. The 
pilot can also disengage the autopilot by depressing a trigger switch on 
the control stick, 

\ 

^ N. 

The Mach trim system is also not a safety of flight parameter. Its 
function is to provide speed stability in the subsonic and low supersonic 
speed regime during manual flight. Loss of this function, however, re- 
quires increased pilot attention and workload in maintaining airspeed. 

To protect against runaway trim failures, a trim power switch is 
located directly ahead of the pilot's left knee for easy access. This is 
necessary for two reasons; loss of pilot mobility due to the pressure suit 
and the multiplicity of circuit breakers. This switch cuts power to all 
trim systems before a runaway trim can cause the requirement of exces- 
sive forces to hold the aircraft in trim. Once the runaway condition is 
stopped, the pilot can locate and pull the proper circuit breakers and then 
reengage the trim power switch to restore power to the unfailed systems. 
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STABILITY AUGMENTATION SYSTEM (SAS) 


As was stated earlier, the F-12 series aircraft have very low pitch 
static stability and yaw directional stability at design flight conditions. 
This requires a greater dependence on stability augmentation during 
maneuvers and during engine- out transients. This, of course, dictates 
significant percentages of full manual authority. The comparative "author- 
ities are shown in Table I. The magnitude of these authorities is such 
that pitch or yaw hardover failures could be catastrophic at certain flight 
conditions. This, combined with the fact that the pitch and yaw SAS 
functions are essential to safety of flight, dictates they be implemented 
with a functional reliability comparable to that of the basic aircraft or 
that of a fly- by- wire system. 


SAS REDUNDANCY AND LOGIC 

Because of the importance of the yaw and pitch SAS's, they are 
implemented with triple- redundancy in sensors, electronics and gain 
scheduling. The roll SAS is not critical, both from the standpoint of 
handling qualities and transients due to hardover failures. However, 
the roll SAS is the inner loop for all of the lateral autopilot modes. 

Thus, to ensure the desired pilot relief and comfort, the roll SAS has a 
dual mechanization. 

The servos for the pitch axis are two dual tandem series servos, 
each dual servo driving an inboard elevon. The tandem pair are coupled 
to each other by a stiff spring such that both servos will track even if 
one is disengaged. If either servo were to jam, the other will still 
perform its function by distorting the spring. This does mean that if 
the "downstream” servo of a, tandem pair were jammed, the pitch SAS 
function would only appear on the other elevon resulting in half gain and 
coupling into roll. However, '"great care is exercised in providing 
adequate filtering of the hydraulic fluid and in addition all main metering 
spool valves are designed to shear any metal chips that might get by. 

Thixs, the probability of jamming is minimal. The yaw axis employs 
four series servos, whiffle tree summed in psdrs, with each pair driving 
a separate vertical. The roll SAS uses two series servos, one for each 
inboard elevon. 

The gain scheduling is obtained from triple- redundant differential 
pressure sensors and altitude switches. These are not part of the Central 
Air Data Computer, and comprise an entirely separate but simple sensing 
package. Because of the high reliance placed on the pitch SAS to provide 
static stability, an additional backup pitch damper (BUPD) is mechanized. 
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This consists of a separate pitch rate gyro and electronics located in a 
controlled environnaent that can be switched into either the A or B servos. 
This system has a fixed gain and is to be used only below 50, 000 feet 
and at subsonic speeds. To date, there is no record of the BUPD ever 
having been used. The purpose of the BUPD was only to provide adequate 

handling qualities for refueling and landing in the event that the basic pitch 

SAS failed due to overheating of the normal pitch gyros. 

Simple block diagrams of the pitch, yaw and roll SAS mechanization 

are shown in Figures 2, 3 and 4. It is seen that the triplex systems 

shown for the pitch and yaw axes employ a monitor channel whose only 
function is to provide a reference for voting. The interceptor version 
was modified in that all three channels of both the yaw and pitch SAS are 
active contributing one-third of the total command. This is illustrated in 
Figure 5 showing the yaw SAS. In that configuration, when the voting 
logic removes a failed channel, the gain of the remaining two channels is 
increased by a factor of 1.5. Override provides full control gain from a 
single channel. On the surface, it would appear that the availability of 
the additional functional channel would enhance the overall reliability. 
However, the additional mechanization complexity tends to offset the re- 
liability advantage. 

The sensor and electronic circuits of the yaw and pitch SAS 
utilize triple redundancy in such a manner that a single failure is fail- 
operational with no change in system performance. This is achieved by 
a voting scheme which selects the "disagreeing” channel and disengages 
it as shown in Figures 2 and 3. A Second or third failure depending on 
failure sequence results in total disengagement of that axis. The use of 
tandem servos in the pitch axis eliminates the need to double the gain in 
the remaining operational channel in order to maintain full system per- 
formance. However, the yaw axis electronic gain in the remaining 
operational channel is automatically doubled to maintain performance 
because of the whiffle tree surnrning mechanization of the series servos. 

Only two channels, A and B, are functional; the M channel is used 
as a reference model. After total disengagement of an axis, if either 
the A or B channels are still functional, the pilot can exercise a logic 
override switch and obtain single channel performance. 

The svervos in both the yaw and pitch channels are essentially quad- 
ruple, but with dual hydraulic supplies. The A hydraulic supply powers 
a right and a lef^ servo that are both being driven by the A electronics. 
The B supply\ powers the remaining two servos which are driven by the 
B electl^onics. Th^xleft and right servos for each hydraulic supply are 
compared and |.f they fail to track, that channel is immediately disengaged. 
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The remaining channel with its associated electronics then properly con- 
trols both the left and right surfaces with a gain equivalent to that of the 
complete system. 

The failure monitoring logic is dual redundant, i. e. , each compari- 
son is independently duplicated. Since a system failure upstream of the 
servos produces two disagreements in the voting scheme, a single dis- 
agreement does not cause a channel disengage, but turns on the M 
channel warning light. A single indicated failure of servo logic will 
cause the related servo channel to disengage and turn on the associated 
warning light. 

The. roll SAS is mechanized as a simple dual system with one 
channel and servo for each side. A cross -monitor is employed in the 
servo feedback loops that disengages both channels in the event of dis- 
agreement. The disengagement is indicated by a failure light between 
the two channel switches. Disengaging and reengaging both switches 
recycles the failure logic to verify the failure. The pilot then exercises 
logic override by switching off both channels and manually engaging one 
channel at a time to test and select the operational channel. The gain 
of this channel is automatically doubled. 

Certain types of servo position pickoff failures would result in limit 
cycle oscillations which would not be detected by the servo logic. There- 
fore, a separate monitor circuit is provided in each servo channel to 
detect open and short circuits in the pickoff primaries and secondaries. 

In order for the pilot to evaluate his situation in the event of failurt 
in the pitch and yaw SAS, a display of lights is presented to him on the 
Function Select Panel located on the right console as shown in Figure 6. 

If any of the lights are on, the pilot pushes the illuminated buttons to 
recycle the logic. Should this fail to reinstate the channels, the pilot 
can then assess his situation in pitch and yaw as shown in Table 2 on 
the assumption that the light indication represents the first failure. Sub- 
sequent failures use tKiSi same lighting sequence and as a result, the 
particular type failure cannot necessarily be isolated. 

One of the major contributors to the maintenance of the F-12 flight 
control system reliability is the Mission Recording System (MRS). 

Each essential parameter of the various vehicle subsystems is monitored 
and properly signal conditioned for use in a magnetic tape recorder. 

The sampling rate for each parameter is once very three seconds. 

During the interval between samples, certain of the more signifi- 
cant parameters are monitored by peak-hold circuits which are reset 
when sampled. In the SAS each active element is monitored. This 
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includes all sensors, gain scheduling devices, amplifiers, servos, and 
logic. This is then made use of in two ways. The first is obviously fault 
isolation; the second is the evaluation of logic performance during system 
checkout. For the latter, the pilot exercises the SAS logic prior to each 
flight and then again as soon as the flight is terminated. This is done 
by activating the logic checkout switch shown adjacent to the function 
selector panel in Figure 6. This initiates a preprogramed, bviilt-in 
test sequence interrogating all SAS logic and AFCS disengage functions. 
Careful perusal of the resultant data tape then reveals the status of SAS 
system and the disengage logic. MRS utilization has also shown that it 
is possible to detect incipient failures. Although it is possible to achieve 
this through use of special software in the data processing, this has not 
been done. Thus, to date, this type of examination is performed visually 
by the data reduction technician. 


RELIABILITY EXPERIENCE 

The Honeywell Corp. was subcontracted to provide the automatic 
flight control system and the air data computer (ADC). The design 
requirements were established by Lockheed. Extremely close coordina«- 
tion and teamwork between Lockheed and Honeywell was maintained in 
order to meet the design goals for the system. How well these design 
goals were attained can be illustrated by the experience with the SAS. 
Honeywell designed and built the nation's first triple-redundant, fail- 
operational SAS for the F-12 series aircraft in the pitch and yaw axes. 

In the thousands of operational flight hours since the inception of the 
program, the pitch and yaw SAS has suffered only two functional failures. 
One was a maintenance error where incomplete installation of the rate 
gyro packages exposed the electrical connectors to high Mach ram air 
temperatures resulting in loss of the pitch axis. The second incident 
occurred when both the pitch A and B servos failed in the same flight. 
There were other instances where all three channels were simultaneously 
disengaged due to power transients during generator failures and sub- 
sequent switchover to the remaining generator. However, the channel, 
disengage logic was immediately recycled and the system functioned 
normally. The one hardware failure during operational usage can be 
equated to a mean time between failure (MTBF) approaching 150, 000 
hours vs. a predicted MTBF of 19,000 hours. These numbers are 
based on total system operating ground and flight hours in an operational 
environment and exclude Category I and Category II flight testing since 
initial testing always involves some problem areas and system modifica- 
tion. 


755 



CONCLUSIONS 


The functional reliability of the F-12 aircraft control systems has 
met and exceeded all expectations. This has been accomplished even 
though the aircraft and many of the control system components must 
operate in the mosl: adverse sustained thermal environment experienced 
by any aircraft in the world. It must be noted, however, that the system 
design stresseti reliability through simplicity. This resulted in minor 
compromise of handling qualities during what are considered transitional 
flight Conditions. This would probably not be acceptable for commercial 
vehicles. Thus, for such applications, more elaborate scheduling and 
control laws would be required placing additional burdens on functional 
reliability. Although the F-12 flight control system was not specifically 
designed as a fly-by-wire system, it has demonstrated all the attributes 
that are required, and has provided a basis for the development of pilot 
acceptance of such sy sterns. 
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Table I - Manual Versus SAS Authority 


PERCENTAGE 
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Figure 1 - AFCS Component Locations 
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